Target IP: 10.10.73.196
Challenge Description:
This challenge contains a downloadable text file.
The content of the downloadable text file is shown above. The objective of this mission is to gain access to the web server by exploiting the web application, and deface the website.
Reconnaissance
There are two TCP ports open on the target machine, as shown above. They are SSH and HTTP on their standard ports.
Performing an aggressive port scan against the open ports returns the result above. I will start enumeration with the HTTP application on port 80.
Running whatweb against the HTTP application returns the technology used above by the target machine. It looks like the target machine is running nginx 1.14.0 as the web server.
Enumeration
Port 80: HTTP
Browsing to the HTTP application displays the webpage above. This webpage contains some names of the owners that might come in useful in later stage. Doing a source-code review contains some useful information.
I performed a directory search and obtained the result above.
Browsing to requirements.txt shows the information above. I guess the technology above is used by the target machine for this web application.
Browsing to /products/1 page displays the webpage above. I tried changing the parameter 1 to 0, but I had no luck. This parameter is dynamic and can be used to browse the different products ranging from one to four.
Exploitation
Using the command sqlmap -u http://10.10.73.196/products/0, I gained the useful information above. It looks like the web application is vulnerable to blind SQL injection. The application sqlmap identified a working payload. Now I can use the --dump flag to dump the contents of the database.
I noticed there is one database with three tables: system_user, user, and product, as shown above. The first two tables sound interesting. Maybe the table system_user contains the admin login?
I managed to dump the contents of the table system_user as shown above. This table contains the email, username, and password hash of three users. One particular user that stands out to me is the server-admin. Now I can crack the password hashes. Before attempting this, I wish to enumerate the user table too.
The database dump of the table user is shown above. This table contains the first flag thm{br3ak1ng_4nd_3nt3r1ng} as shown above. I did not find anything useful here. Time to crack the password hashes of the users from the table system_user.
I copied the password hashes of the users and stored them in a file called passwd. I ran the command cat to show the content of this file as shown above. Then using john, I attempted password cracking. I successfully managed to crack the password of the user server-admin, as shown above. Now I have the credentials server-admin:inuyasha.
From directory search enumeration, I found the admin webpage at /admin. Browsing to this directory displays the webpage above. I used the credentials of the user server-admin here, but I had no luck.
However, I was able to use the credentials against SSH and gain access to the target machine as shown above. Now I have a foothold on the target machine as the user server-admin.
Privilege Escalation
Running sudo -l shows the interesting commands that can be executed as the user root without password. If the config file duckyinc.service can be edited then I can obtain a root shell.
Using the command find / -name "duckyinc.service" 2>/dev/null, I tried to identify this config file and obtained the interesting results above. I do not have the permission to overwrite this file. However, from previous image, I noticed sudoedit can be used. Maybe I can use this binary to change the config file as the user root?
And bingo! I can modify the config file /etc/systemd/system/duckyinc.service as the user root using the binary sudoedit as shown above. To accomplish this, I used the command sudo sudoedit -u root /etc/systemd/system/duckyinc.service. The default config settings are shown above for this file.
Then I made changes to the config file as shown above. I changed the User, Group, and ExecStart lines. The ExecStart contains the bash reverse shell script to connect to my machine at port 8443. And the User and Group lines makes sure I obtain the session as user root for the reverse shell connection.
I started a listener on my machine at port 8443. Then I executed the commands sudo systemctl daemon-reload and sudo systemctl restart duckyinc.service. And I obtained a root shell on port 8443. Now I have a root shell. And the last objection of this mission is to deface the website. Since I have root privileges, I can deface the HTML pages.
I created the deface HTML page above on my machine.
I hosted the deface index.html page on my machine using Python http.server. And I transferred this to the target machine via wget. I replaced the default index.html with my index.html deface page from the previous image. I removed the changes from the malicious /etc/systemd/system/duckyinc.service config file to invoke the reverse shell connection to my machine. Then I used the commands sudo systemctl daemon-reload and sudo systemctl restart duckyinc.service to restart the service. After making the changes, I notice the flag3.txt has appeared.
Now browsing to http://10.10.73.196 displays my defaced webpage above. Mission accomplished. I successfully defaced the index.html.
Flags
The flag1 is shown above. This flag is located inside the user table of the duckyinc database.
The flag2 is shown above. This flag is obtainable after gaining a foothold on the target machine.
The flag3 is shown above. This flag is readable after defacing the index.html.